CVE-2026-37429: SQL Injection in qihang-wms

The primary impact of this SQL Injection vulnerability lies in the potential for unauthorized access to the qihang-wms database. An attacker could craft malicious SQL statements through the datascope parameter to bypass security controls and directly query the database. This could lead to the exfiltration of sensitive user data, including usernames, passwords, addresses, and other PII. Depending on the database schema and permissions, an attacker might even be able to modify or delete data, leading to data integrity issues and service disruption. The blast radius extends to any system relying on the compromised qihang-wms data, potentially impacting downstream applications and integrations.

1. Reserved2026-04-06
2. Published2026-05-13

Due to the lack of a specified fixed version, immediate mitigation focuses on preventing exploitation. The most effective short-term solution is to implement strict input validation on the datascope parameter, ensuring that all user-supplied data is properly sanitized and escaped before being used in SQL queries. Web Application Firewalls (WAFs) configured with rules to detect and block SQL Injection attempts can provide an additional layer of defense. Consider using parameterized queries or prepared statements, which automatically handle escaping and prevent SQL Injection. Regularly review and update the qihang-wms codebase to address potential vulnerabilities. After patching (when available), thoroughly test the application to confirm the vulnerability is resolved and no new issues have been introduced.